update readme according to new Dockerfile

Dockerfile

@@ -1,18 +1,56 @@
 FROM golang:alpine as builder
 
-ENV GO111MODULE=on
+# ------------------------ #
+# (1) install dependencies
+# ------------------------ #
+
+# git is needed for go modules
 RUN apk add git
+
+# upx to shrink executable size
+ARG UPX_VERSION="3.96"
+RUN apk add curl && \
+	curl -L https://github.com/upx/upx/releases/download/v${UPX_VERSION}/upx-${UPX_VERSION}-amd64_linux.tar.xz -o /tmp/upx.tar.xz && \
+	tar -xf /tmp/upx.tar.xz -C /tmp/ && ls /tmp;
+
+# copy sources
 ADD . /app
-
 WORKDIR /app
-RUN go mod download
-RUN CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o binary
 
-FROM alpine:latest as production
+# compile
-RUN mkdir /app
+RUN go mod download && \
-COPY --from=builder /app/binary /app
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o /app/binary
-COPY --from=builder /app/api.json /app
+
+# shrink executable
+RUN /tmp/upx-${UPX_VERSION}-amd64_linux/upx --brute /app/binary
+
+# create appuser
+ENV USER=appuser
+ENV UID=10001
+
+# See https://stackoverflow.com/a/55757473/12429735RUN
+RUN adduser \
+    --disabled-password \
+    --gecos "" \
+    --home "/nonexistent" \
+    --shell "/sbin/nologin" \
+    --no-create-home \
+    --uid "${UID}" \
+    "${USER}"
+
+FROM scratch as production
+
+# import the user and group files from the builder.
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/group /etc/group
+
+# copy executable & config
+COPY --from=builder /app/binary /app/
+COPY --from=builder /app/api.json /app/
+WORKDIR /app/
+
+# Use an unprivileged user.
+USER appuser:appuser
 
-WORKDIR /app
 EXPOSE 4242/tcp
-CMD "/app/binary"
+CMD ["/app/binary"]

README.md

@@ -6,13 +6,19 @@
 go get -u git.xdrm.io/go/tiny-url-ex
 ```
 
-### 2. launch the server
+### 2. launch in docker
 
-```
+Build the image.
-$ go run .
+```bash
+$ docker build -t tiny-url .
 ```
 
-Now you can play with it with any regular REST API client at `127.0.0.1:4242`.
+Then you can run the container with :
+```bash
+$ docker run -p 127.0.0.1:8888:4242 tiny-url
+```
+
+You can now play with it with any regular REST API client at `127.0.0.1:8888`.
 
 ##### 1. Get an authentication token
 

main.go

@@ -13,7 +13,7 @@ import (
 
 func main() {
 
-	listenTo := "127.0.0.1:4242"
+	listenTo := ":4242"
 
 	// 1. build server
 	log.Printf("[server] building")